Categories

The Movie Database Support

MOD

on March 5, 2014 at 6:12PM

Hi everyone,

There's going to be some changes to the rate limiting we do on the API coming up shortly. This won't affect the rate limits themselves but rather how we calculate them and what we return. I'm happy to answer any specific questions should have one.

Let me first outline the key problems with our current system. Right now our API web servers are load balanced using Amazon's Elastic Load Balancer (ELB). When we first started doing this we only had 2 servers. With Nginx in front taking care of the rate limiting it worked ok for us. Keep in mind, Nginx doesn't share any kind of a hash table so each IP was technically, rate limited separately on each server. At 2 servers we were ok with this since the way we split traffic was generally by IP to each individual availability zone. This meant that mostly everyone's requests ended up at the same Nginx instance.

Fast forward to 2014 and our API web server cluster is 8 servers which is now making any attempt to rate limit with Nginx almost useless.

The new system will share the state of an IP address across all 8 instances and provide proper balanced rate limiting. The rate limits themselves remain unchanged (max. 30 requests in a 10 second span). The key difference is in the response handling during your requests and when you trip the rate limits. I'll give you some examples so you can make changes to your code before we go live with this change.

X-RateLimit-Limit: The number of requests you're allowed to make in a 10 second span.

X-RateLimit-Remaining: The number of requests you have left before the counter resets.

X-RateLimit-Reset: The Epoch timestamp when the counter will reset.

Right now when you actually trip the rate limits, we just throw a 503 error which is really not the right way to do this. Moving forward, we'll be throwing a proper 429 status code along with a Retry-After header telling you how many seconds to wait until you're allowed to make a request again. It looks like so:

on March 6, 2014 at 4:51AM

on March 6, 2014 at 9:02AM

Are the servers solid state based now?

Our DB and web servers are, yes. The SSD's have close to no effect on the web servers though as everything is served from memory. We do very, very little IO. The bigger difference we noticed was just bumping to the new c3 instances with their better CPU's.

No more need for rate limiting :D

This has no bearing on us choosing to rate limit. We have had a lot of trouble with people pushing code into the wild that ends up stuck in loops forever and ever (we had one client in particular that was generating over 6,000 requests per second all by itself, looping forever and ever until we got the developer to push a fix for it). When you process the kind of requests we do it just becomes a natural requirement—we can't let a few bad developers ruin the experience for everyone.

on May 20, 2015 at 11:08AM

on May 20, 2015 at 6:49PM

This is a completely reasonable restriction in theory, but not on an API that is so frustratingly limited in methods for retrieving data.

I have a simple app that is basically an alternate view of a user's list. It pulls the list and then displays a table with title, runtime, poster, director, etc. This is what the API currently requires me to do:

GET /list/list_id

For each movie in list, GET /movies/movie_id

For each movie in list, GET /movies/movie_id/credits

For a list with 50 movies, this is 101 API calls just to get a couple kilobytes of data. With no way to get more than one movie at a time (by ID) and such a small selection of attributes returned for a list's movies, I'm already forced to mirror the data in a local database. Now when a user's list has more than a dozen movies I haven't mirrored yet, I hit the API limit.